[Nagi-Inaba]

Problem

Duplicate registered artifact paths were compared through pathKey(), which folds case only on win32. The default macOS filesystem (APFS) is case-insensitive too, so two artifact paths that differ only in case were not detected as duplicates there. The only existing test for this is win32-only, so macOS CI never exercised the rule.

Change

• Add artifactPathKey(value, platform = process.platform) to safe-file-io.mjs. It folds case when the platform is win32 or darwin, and the platform is injectable for tests.
• Use it only for the two identity checks: the duplicate canonical path check in audit-run-validation.mjs and the duplicate check at registration in audit-run.mjs.
• Symlink, junction, reparse-point and containment comparisons keep their exact semantics on every platform. Folding case there would hide a case-only symlink on a case-sensitive volume.
• Detection is deliberately fail-closed: a case-sensitive macOS volume can report a false duplicate.
• Add tests/artifact-path-identity.test.mjs (platform-injected unit tests) to the tests and to release-files.json, and a CHANGELOG entry.

Verification

• node --test tests/artifact-path-identity.test.mjs tests/module-dependency.test.mjs: 13 pass, 0 fail
• node --test --test-name-pattern="canonical|duplicate" tests/audit-orchestration-cli.test.mjs: 8 pass, 0 fail
• Related suites that import safe-file-io.mjs, audit-run.mjs or audit-run-validation.mjs: 253 tests, 0 fail
• node scripts/verify-all.mjs passed on the combined branch of all four fixes (95 test files, Windows / Node.js 24.19.0); remote CI runs it here, including the macOS cells
• The darwin behavior is covered by platform-injected unit tests only. The existing CLI duplicate test is win32-only, so no test registers real case-differing files on a macOS volume; the macOS CI cells here run the injected tests
• Codex / Claude parity is not affected (shared files changed and the distributions were regenerated; sync-distributions --check is clean)

Compatibility

• Schema/profile/procedure version impact: none
• Migration required: no. On macOS, a run that registered paths differing only in case is now rejected
• CHANGELOG updated

Security and privacy

• No credentials, private URLs, local paths, or real audit evidence are included
• Public-report/privacy boundaries are unchanged
• Release preparation, publication and remote CI results are reported separately

Issue

Part of the 2026-10-19 review fixes (P17 in the internal review). Closes no issue.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T11:16:06.837298Z	e86c481	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.